Bloom Security
AI overview
Sign in and the AI will write an overview from our coverage.
Headlines · 1
- SlugFest: npm Trusted Publishing flaw hit 1,500+ packages as AI agents raise risk
Security firm Bloom Security disclosed a vulnerability dubbed SlugFest in npm Trusted Publishing: npm originally bound trust to a GitHub repository's human-readable slug rather than recording its permanent repository identifier, so once a repo is renamed, transferred or deleted, the old address can be claimed by someone else and satisfy the original trust configuration — granting publishing access without stealing the maintainer's credentials. A registry-wide scan found more than 1,500 vulnerable packages with over 10 million combined downloads and more than one million downloads per month, though Bloom notes these are only packages configured for Trusted Publishing. Bloom also measured AI-driven installs inside large enterprises, finding a typical endpoint receives roughly 70 agent-installed packages a month versus close to 350 on developer machines, and said it blocked one customer's AI agent from installing an affected package. npm implemented a fix before publication and confirmed the remediation; Bloom recommends storing immutable repository and owner identifiers and checking trust bindings after renames or transfers.
The Next Web · 🔥 0
Experience and discussion from the community
Share my Bloom Security experienceAsk about Bloom Security
Nobody has shared their experience with Bloom Security yet.